These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint vulnerability allows any authenticated user to read field values from other workspaces. This issue poses a risk to data confidentiality. Defenders should assess exposure and implement compensating controls to restrict access to sensitive data. The vulnerability was published on 2026-10-20T15:40:23.156Z and has not been [truncated]
A low-privileged authenticated user can exploit an SQL injection vulnerability in Baserow versions 2.2.0 through 2.3.3 by providing a malicious Formula field value. This allows data to be read or modified outside the user's workspace permissions. The vulnerability exists in the index() formula function, which treats a provided fourth argument as a SQL template. The generated SQL runs with the privileges o [truncated]
CVE-2026-81335 debrief: Baserow 2.3.0 data source dispatch bypasses permission checks, allowing unauthenticated data access. The vulnerability exists in the dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py, which are declared with a permission class that admits any caller. Vendor released version 2.3.1 with a fix that passes raise_exception to the permission [truncated]
A stored cross-site scripting (XSS) vulnerability exists in Baserow, a web-based application. The issue arises from the interpolation of a user's display name into rich-text mention markup without proper HTML encoding. Specifically, the PATCH /api/user/account/ endpoint stores the first_name value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js constructs a template liter [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-04T22:17:14.117Z and has not been modified since then. The NVD entry is currently Received. A potential vulnerability exists in Baserow up to 2.3.2 in the Inactive Non-Staff User Handler component, related to improper authorization with a low CVSS score of 2.1. The project maintainer considers it mo [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-04T22:17:13.930Z and has not been modified since then. The vulnerability identified in Baserow up to 2.3.2 affects the function verify of the file backend/src/baserow/api/two_factor_auth/views.py of the component 2FA Verify Endpoint, leading to improper authentication. The attack may be launched rem [truncated]